feat: validate semver range

Closes #6

Author: dominykas

lib/index.js

@@ -4,6 +4,7 @@ const Cp = require('child_process');
 const Fs = require('fs');
 const Npm = require('libnpm');
 const Path = require('path');
+const Semver = require('semver');
 const Topo = require('topo');
 
 
@@ -131,11 +132,24 @@ exports.run = async (options) => {
                 throw new Error(`No entry for ${name}`);
             }
 
-            if (!allowScripts[name]) {
+            if (allowScripts[name] === false) {
                 console.warn(`==========> skip ${path} (because it is not allowed in package.json)`);
             }
 
-            return allowScripts[name];
+            if (allowScripts[name] === true) {
+                return true;
+            }
+
+            if (!Semver.validRange(allowScripts[name])) {
+                throw new Error(`Invalid version range in allowedScripts[${name}]: ${allowScripts[name]}`);
+            }
+
+            if (!Semver.satisfies(childPkg.version, allowScripts[name])) {
+                console.warn(`==========> skip ${path} (because ${childPkg.version} is outside of allowed range: ${allowScripts[name]})`);
+                return false;
+            }
+
+            return true;
         });
 
     await internals.runScript('preinstall', { pkg, path: '', cwd, unsafePerm: true }, options);

package.json

@@ -1,7 +1,7 @@
 {
   "name": "allow-scripts",
   "version": "0.0.0",
-  "description": "Execute allowed lifecycle scripts",
+  "description": "Execute allowed `npm install` lifecycle scripts",
   "main": "lib/index.js",
   "repository": {
     "url": "https://github.com/dominykas/allow-scripts.git"
@@ -15,12 +15,13 @@
   "author": "Dominykas Blyžė <hello@dominykas.com>",
   "license": "MIT",
   "dependencies": {
-    "libnpm": "^2.0.1",
-    "topo": "^3.0.3"
+    "libnpm": "2.x.x",
+    "semver": "5.x.x",
+    "topo": "3.x.x"
   },
   "devDependencies": {
-    "lab": "^18.0.1",
-    "semantic-release": "^15.13.3"
+    "lab": "18.x.x",
+    "semantic-release": "15.x.x"
   },
   "files": [
     "bin",